From 85f81a4c8017a138e10a5ffe1eaf30c626379d25 Mon Sep 17 00:00:00 2001 From: schmeeve Date: Fri, 12 Jun 2026 10:59:21 -0700 Subject: [PATCH] aur compromised package check --- aur_check.sh | 474 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 474 insertions(+) create mode 100755 aur_check.sh diff --git a/aur_check.sh b/aur_check.sh new file mode 100755 index 0000000..6822c49 --- /dev/null +++ b/aur_check.sh @@ -0,0 +1,474 @@ +#!/usr/bin/env bash + +# AUR atomic-lockfile malware check - June 11 2026 +# Sources: +# https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/ +# https://gr.ht/aur_pkg_list.txt + +INFECTED_PKGS=( + 123pan-bin + 1code + 8192eu-dkms-git + actual-ai + adblock2privoxy + aion-git + albion-online-launcher-bin + alienfx + alvr + android-signapk + android-signapk-gui + annobin + ansible-language-server + antfs-cli-git + anythingllm-appimage + anythingllm-cli-bin + apk-installer-gui + apm_planner-bin + apothem + apple-music-desktop + arch-update-vai + archjh + archlinux-themes-slim + archmage + archtex-git + artanis-git + astro-editor-appimage + autohand-cli + autolabel + autologin + azurlaneautoscript + bcachefs-kernel-dkms-git + beebeep + bitcoin-core-git + blinkenlib + blueproximity-py3-git + booklore + brow6el + brow6el-git + canon-pixma-mg3000-complete-fixed + cartridge-cli + ccase-bin + ccl-git + cgminer + charcoal + cinny-desktop-system-tray + clai + clang19 + clash-mi + cling-git + cmuclmtk + cnijfilter-common + codenomad-bin + codeql-cli-bin + cogpit-bin + colorhug-client + colorz + compiler-rt19 + compizconfig-python + coolreader + cowdancer + cutefish-calculator + cutefish-core + cutefish-dock + cutefish-filemanager + cutefish-icons + cutefish-launcher + cutefish-qt-plugins + cutefish-screenlocker + cutefish-screenshot + cutefish-settings + cutefish-statusbar + cutefish-wallpapers + cvs-feature-bin + cynthiune.app + dagu-bin + datatype99 + deheader + dep + dh-python + difi + difi-bin + doctoc + dots-hyprland-fork-git + dvdrip + dyad-bin + easy_spice + edconv-bin + eisl + epson-inkjet-printer-escpr2-clos-bin + exodus-wallet-bin + exoduswallet + farmmod-hub + fastoggenc + fastjet + fatx + fcitx5-pinyin-sougou-dict-git + ffmpeg-bitrate-stats + ffmpeg-quality-metrics + findpkg-git + firefox-extension-adnauseam-bin-amo + firmium-desktop-git + fishui + fishui-git + flexiblas + flynarwhal + fmlib + forgecode-bin + formidable-bin + frame + ftl + frutool + futhark-bin + gdl + gdlmm + git-annex-standalone + gnome-contacts-git + gnutls3.8.9 + gopher2600 + gopher2600-bin + gosh + gpx-viewer + graveman + green-tunnel-bin + greetd-wlgreet-git + gtkimageview + guile-reader + gummy + gummy-git + hackmatrix-git + harmony-wad + headphones + hearthstone-linux-gui-appimage + hearthstone-linux-gui-bin + hepmc2 + hister-git + hnswlib-git + horst + hydownloader-git + hydrus-git + i3bar-river + ianny-bin + ibm-sw-tpm2 + ihaskell-git + imageglass + inadyn + indicator-session + infnoise-openssl-git + interface99 + ios-webkit-debug-proxy + ipfs-desktop-bin + ipsw + iron-heart-git + jasp-desktop + jd-gui + k3sup + kdb + kddockwidgets-git + kexi + kiss + ktea + kookbook + kproperty + kreport + latex-digsig + lazylpsolverlibs-git + lesstif + lib32-egl-wayland + libafterimage + libbobcat + libcutefish + libffi-static + libgdata + libjxl-noglycin + libquvi + libquvi-scripts + libretro-hatari-enhanced-git + libxdiff + libxml-ruby + libyami + linux-cachyos-deckify-native + linux-cachyos-native + linux-cachyos-rc-native + linux-tool + liri-cmake-shared-git + lite + lll + llvm-cbe-git + lowfi-bin + "ls++" + lucidvideo + m5rcode + magpie-wm + mako-center-git + manuskript + maszyna-git + mathsat-5 + matrixbrandy + mcp-probe + mcpatcher + mermaid-ascii-git + mermark-editor + mesa-dlss-reflex-git + mimic-node-git + mingw-w64-geos + mingw-w64-libsndfile + minimax-bin-hardened + misuzu-music-bin + mono-addins + monochrome + monochrome-git + moor-git + mount-gtk + mopen + n1-translator + naemon + naemon-livestatus + natapp + nebuchadnezzar-git + neovim-autopairs-git + neovim-nvim-treesitter + nerf-pi + neuro-karaoke-wrapper-git + new-api-privacy-filter + new-api-privacy-filter-git + nexus-bin + nginx-mod-vts + nhentai-git + nocodb + noctyra-dotfiles-git + "notepad---bin" + nox-bin + nrpe + nwchem-bin + ob-xd + octocode + opencode-codebase-index-bin + openui5 + opl-synth + optimizevideo-git + oracle-bin + pacforge + paper-desktop-bin + paq8o + parallel-python + pass-cli + pelican-git + penguin-subtitle-player + perl-proc-parallelloop + perl-set-object + perl-term-extendedcolor + phonon-qt5-vlc + php-geoip + php-memcache + php-openswoole-git + php-xdiff + picom-ftlabs-git + pidgin-kwallet + pipetoys + pipewire-visualizer-git + premake-git + prisma4postgres-bin + profile-sync-daemon-zen + pymacs + pypiserver + pypy-setuptools + python-argdispatch + python-awkward + python-calmjs + python-celery + python-ci-info + python-coolname + python-cu2qu-git + python-dataproperty + python-dbapi-compliance + python-dictobject + python-dj-database-url + python-fastmcp-slim + python-finnhub-python + python-firebase-admin + python-fmu_manipulation_toolbox + python-future + python-g4f + python-hist + python-histoprint + python-hsaudiotag3k + python-iminuit + python-iso3166 + python-isr-git + python-jsmin + python-json2xml + python-luckydonald-utils + python-milvus-lite-bin + python-mmcif + python-monotonic + python-mplhep + python-mplhep_data + python-netaudio-git + python-netaudio-lib + python-newspaper4k + python-nipype + python-nodejs-wheel + python-openai-harmony + python-pdf2docx + python-piecash + python-pluginmgr + python-poetry-plugin-dotenv + "python-pushbullet.py" + python-pychromecast-git + python-pylsp-rope + python-pymilvus + python-pysocks-git + python-rembg + python-scikit-hep-testdata + python-sklearn-pandas + python-sqliteschema + python-starlette-compress + python-starsessions + python-steamcontroller-git + python-tabledata + python-tarantool + python-tradingeconomics + python-uhi + python-uproot + python-vector + python-xtarfile + python2-appdirs + python2-fusepy + python2-lazr-uri + python2-mutagen + python2-notify + python2-packaging + python2-paver + python2-pyparsing + python2-simplejson + python2-simpleparse + python2-stomper + python2-twodict-git + python2-xlib + qhttpengine + qlementine + qmdnsengine + qnapi + qobuz-player-bin + qtum-core + quickswitch-i3 + r-dbplyr + reactphysics3d + repoporge + retibbs-client-git + rhythmbox-git + rimworld + rog-helper-git + ros2-humble-nav2-msgs + ruah-orch + ruby-excon + ruby-kramdown-rfc2629 + ruby-selenium-webdriver + runescape-launcher + sakura-launcher-gui + sandlock + screenpipe-bin + sdcc-bin + seahorse-nautilus + shhmsg + shhopt + slipnet + slipnet-bin + smenu + smenu-git + smolrtsp + smolrtsp-libevent + snry-shell-qs + soapyptezuka + solara-kernel-headers + sonosano + soundpaad-bin + sshuttlee + sshuttlee-bin + stompbox-jack-git + stripe-cli + stylelint-config-recommended + subbrute + sublist3r-git + subprocess + subsync + svu + sway-xkb-switcher + tack + tarantool + tesseract-gui + thunar-nextcloud-plugin + thunderbird-conversations + tinyemu + tlpui-git + torch7-git + touchhle + touchosc-bin + transcreen + tsm + ttf-material-design-icons-git + tunacode-cli + typing-game-cli + ukui-notification-daemon + vapoursynth-preview-git + vbam-git + verso-git + vidcutter + vim-easymotion + vim-gitgutter + vim-indent-object + vim-molokai + vim-solidity + vim-vital + vocalinux-git + voquill-gpu + wallpaper-generator-next + wayland-static + we-layerd-git + whatsie-git + whisper2tr + whisper2tr-git + windowmaker-git + wine-nine + wire-desktop + word-snatchers-cli + workbench + workbuddy-bin + wrystr-git + wsjtx-beta + xf86-input-mtrack-git + xorg-xfsinfo + xplot + xpra-html5 + xray-domain-list-community + yarg + yt6801-dkms + yy + zathura-gruvbox-git + zerx-lab-dida-bin + zerx-lab-zed-nightly-bin + zing-8-bin + zing-17-bin + zing-21-bin + zinnia-python + zsdx +) + +echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..." +echo + +found=() +for pkg in "${INFECTED_PKGS[@]}"; do + if pacman -Qi "$pkg" &>/dev/null; then + found+=("$pkg") + fi +done + +if [[ ${#found[@]} -eq 0 ]]; then + echo "Clean: none of the known infected packages are installed." +else + echo "WARNING: ${#found[@]} infected package(s) found:" + for pkg in "${found[@]}"; do + echo " - $pkg" + done +fi \ No newline at end of file